메세지로그 파일 내용분석 부탁 드립니다.

May 22 11:58:30 www kernel: printk: 9 messages suppressed.
May 22 11:58:30 www kernel: martian source 0.0.0.0 from 207.203.140.5, on dev eth0
May 22 11:58:30 www kernel: ll header: 00:30:48:32:a5:14:00:08:88:ef:d4:66:08:00
May 22 11:58:30 www portsentry[2849]: attackalert: Possible stealth scan from unknown host to TCP port: 21 (accept failed)
May 22 11:58:34 www last message repeated 145546 times
May 22 11:58:34 www kernel: printk: 7 messages suppressed.
May 22 11:58:34 www portsentry[2849]: attackalert: Possible stealth scan from unknown host to TCP port: 21 (accept failed)
May 22 11:58:34 www kernel: martian source 0.0.0.0 from 207.203.140.5, on dev eth0
May 22 11:58:34 www kernel: ll header: 00:30:48:32:a5:14:00:08:88:ef:d4:66:08:00
May 22 11:58:34 www portsentry[2849]: attackalert: Possible stealth scan from unknown host to TCP port: 21 (accept failed)
May 22 11:58:40 www last message repeated 189184 times
May 22 11:58:40 www kernel: printk: 9 messages suppressed.
May 22 11:58:40 www kernel: martian source 0.0.0.0 from 207.203.140.5, on dev eth0
May 22 11:58:40 www kernel: ll header: 00:30:48:32:a5:14:00:08:88:ef:d4:66:08:00
May 22 11:58:40 www portsentry[2849]: attackalert: Possible stealth scan from unknown host to TCP port: 21 (accept failed)
May 22 11:58:44 www last message repeated 145073 times
May 22 11:58:44 www kernel: printk: 7 messages suppressed.
May 22 11:58:44 www portsentry[2849]: attackalert: Possible stealth scan from unknown host to TCP port: 21 (accept failed)
May 22 11:58:44 www kernel: martian source 0.0.0.0 from 207.203.140.5, on dev eth0
May 22 11:58:44 www kernel: ll header: 00:30:48:32:a5:14:00:08:88:ef:d4:66:08:00
May 22 11:58:44 www portsentry[2849]: attackalert: Possible stealth scan from unknown host to TCP port: 21 (accept failed)
May 22 11:58:48 www last message repeated 132756 times
May 22 11:58:48 www kernel: printk: 8 messages suppressed.
May 22 11:58:48 www kernel: martian source 0.0.0.0 from 207.203.140.5, on dev eth0
보안상 소스 아이피는 0000으로 바꾸었습니다.

어제부터 저 아이피에서 계속 저럽니다.

아이피 조회 해보니 미국아이피 입니다.

첨에 발견하게된 계기가 netstat -anp 로 검색을 해보니

저 아이피가 pop3 포트로 계속 들어오는 겁니다.

maillog 파일에 보면 저 아이피로 접속후 아무 아이디나 쳐대면서

접속을 하려고 하는것 같았습니다..

bellsouth.net 이란 포탈 사이트 같은데

팝으로 들어오려고 하는걸 보니..메일에 관련된 것인지 모르겠구요.

iptables 와 hosts.deny ,route add -host ... reject에 등록은 해놔서 접속은 안돼는데

커널 파라미터 조정 하면서

[root@www ~]# echo "1" > /proc/sys/net/ipv4/conf/all/log_martians<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />

이걸 해놨더니 메세지 파일에 계속 저게 나옵니다.

저걸 어떻게 처리해야 할까요?